I suspect the CSN is available as an operational attribute on
each entry
If it is, I can't find it. Plus, a CSN seems to be associated with a change, not an
entry. Like, if I changed a user's city and then changed their initials, that would be
two different changes, each with its own CSN. Would the entry contain both? How would you
know what changes each entailed?
I thought the changelog was queryable via LDAP, somehow
Since asking the question, I've been doing some research and found that the
"cn=changelog" tree is populated by the "Retro Changelog Plugin", and
on my systems, that has a config that limits it to the "cn=dns" subtree in my
domain. I guess that's the default config either for the plugin itself or for IdM. I
did temporarily change the config on a test server, and it started reporting new CSNs as
they came in, and it shows the target DN for each CSN, but the change itself is
encapsulated in a blob.
The cn=changelog5,cn=config entry contains the on-disk location of the changelog where its
saved as a Berkeley DB. It's almost as easy to pull the same data out of there.
It's good to know that I'm not just missing something obvious, though. Thanks.